While the primary roles for information security are relatively easy to identify (but somewhat more challenging to implement), organizational dynamics in outsourced organizations complicate matters. A process-based approach facilitates practical allocation of responsibilities.

As organizations continue to look toward outsourcing IT functions, the implications on the information security organization must be managed effectively. The act of outsourcing IT functions does not constitute the transfer of risk, or for that matter, accountability for information risk management. Indeed, it places additional burdens on security leadership to ensure security activities are aligned among multiple parties. Furthermore, outsourcing must not result in the abandonment of separation-of-duties principles.

By Tom Scholtz at ZDNet.

[ Read more ]